lainwir3d/dolibarr
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Fix vulnerability reported by DIGITEMIS CYBERSECURITY & PRIVACY

Browse Source
This commit is contained in:
Laurent Destailleur 2018-03-10 18:40:45 +01:00
parent e3ace1f89f
commit 3911738b88
2 changed files with 10 additions and 11 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
htdocs/expensereport/card.php
View File

@ -2028,15 +2028,14 @@ else
print dol_getIdFromCode($db, $line->fk_c_exp_tax_cat, 'c_exp_tax_cat', 'rowid', 'label'); print dol_getIdFromCode($db, $line->fk_c_exp_tax_cat, 'c_exp_tax_cat', 'rowid', 'label');
print '</td>'; print '</td>';
} }
// print '<td style="text-align:center;">'.$langs->trans("TF_".strtoupper(empty($objp->type_fees_libelle)?'OTHER':$objp->type_fees_libelle)).'</td>'; print '<td class="center">';
print '<td style="text-align:center;">';
$labeltype = ($langs->trans(($line->type_fees_code)) == $line->type_fees_code ? $line->type_fees_libelle : $langs->trans($line->type_fees_code)); $labeltype = ($langs->trans(($line->type_fees_code)) == $line->type_fees_code ? $line->type_fees_libelle : $langs->trans($line->type_fees_code));
print $labeltype; print $labeltype;
print '</td>'; print '</td>';
print '<td style="text-align:left;">'.$line->comments.'</td>'; print '<td style="text-align:left;">'.dol_escape_htmltag($line->comments).'</td>';
print '<td style="text-align:right;">'.vatrate($line->vatrate,true).'</td>'; print '<td style="text-align:right;">'.vatrate($line->vatrate,true).'</td>';
print '<td style="text-align:right;">'.price($line->value_unit).'</td>'; print '<td style="text-align:right;">'.price($line->value_unit).'</td>';
print '<td style="text-align:right;">'.$line->qty.'</td>'; print '<td style="text-align:right;">'.dol_escape_htmltag($line->qty).'</td>';
if ($action != 'editline') if ($action != 'editline')
{ {
@ -2096,7 +2095,7 @@ else
// Add comments // Add comments
print '<td>'; print '<td>';
print '<textarea name="comments" class="flat_ndf centpercent">'.$line->comments.'</textarea>'; print '<textarea name="comments" class="flat_ndf centpercent">'.dol_escape_htmltag($line->comments).'</textarea>';
print '</td>'; print '</td>';
// VAT // VAT
@ -2147,7 +2146,7 @@ else
print '<td colspan="3"></td>'; print '<td colspan="3"></td>';
print '</tr>'; print '</tr>';
print '<tr '.$bc[true].'>'; print '<tr class="oddeven">';
print '<td></td>'; print '<td></td>';
@ -2179,7 +2178,7 @@ else
// Add comments // Add comments
print '<td>'; print '<td>';
print '<textarea class="flat_ndf centpercent" name="comments">'.$comments.'</textarea>'; print '<textarea class="flat_ndf centpercent" name="comments">'.dol_escape_htmltag($comments).'</textarea>';
print '</td>'; print '</td>';
// Select VAT // Select VAT

8
htdocs/expensereport/note.php
View File

@ -19,9 +19,9 @@
*/ */
/** /**
* \file htdocs/commande/note.php * \file htdocs/expensereport/note.php
* \ingroup commande * \ingroup expensereport
* \brief Fiche de notes sur une commande * \brief Tab for notes on expense reports
*/ */
require '../main.inc.php'; require '../main.inc.php';
@ -90,7 +90,7 @@ if ($id > 0 || ! empty($ref))
print '<div class="fichecenter">'; print '<div class="fichecenter">';
print '<div class="underbanner clearboth"></div>'; print '<div class="underbanner clearboth"></div>';
var_dump($value_public);
$cssclass="titlefield"; $cssclass="titlefield";
include DOL_DOCUMENT_ROOT.'/core/tpl/notes.tpl.php'; include DOL_DOCUMENT_ROOT.'/core/tpl/notes.tpl.php';